JUt. 12. 2005 2:53PM (3) FISH & RICHARDSON 6175428906 



NO. 1720 P. 4 



Applicant 
Serial No, 
Filed 
Page 



Jason DeBettencourt et at 
10/549,160 
August 27, 2003 
2 of 25 



Attorney's Docket No. : 1 7542-002001 




Amendments t o the Claims 
This listing of claims replaces all prior versions and listings of claims in the application: 

Listing of Claims: 

1 . (previously presented) A method for filt*rm S dntn from a data ctroam of 
monitoring a distributed computing system that in operating includes a dat» fitream pass{np 
messages to or from an appli cation in the ^ tern. the mp.tl,^ comprising: 

resemflg monitoring [a] messages^assmg on the data stream, include n.mrii»rin r » 
first message on the data stream: 

evaluating, using data from the first message, a current set of one or more rules producing 
a current set of evaluated rules; and 

oollocting recordin g data associated with the first message in accordance with the current 
set of evaluated rules. 

2. (currently amended) The method of Claim 1, wherein said evaluating and said 
gafeeriag recordin g are performed while said w e b Gorviooc applioatio ii distributed com P .itm ff 
system is servicing requests. 

3 . (currently amended) The method of Claim 1 , further comprising: 
specifying a first set of rules; and 

specifying a second set of rules while said wab copiooo applioatiou distributed commitim* 
system services requests and filters data from said web corvicoo applioatiou'i) distributed 
c omputing system's data stream, said second set of rules replacing said first set of rules as said 
current set of rules. 
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4. (currently amended) The method of Claim 3 , whorein paid moccago in a firct mopoago 
and tho method further comprising; 

associating a first session structure with said first message from said data stream, said 
first session structure including a representation of said first set of rules; and 

associating a second session structure with a second message from said data stream, said 
second session structure including a representation of said second set of rules, a portion of a 
processing lifetime of said first message overlapping at least a portion of a processing lifetime of 
said second message. 

5. (original) The method of Claim 4, wherein processing of said first message is 
complete and the method further comprising: 

determining if said first set of rules included in said first session structure is a current set 
of rules; and 

designating said first session structure for reuse in processing another incoming message 
if said first set of rules is said current set of roles. 



6. (original) The method of Claim 5, further comprising: 
receiving said second message; 

determining whether there are any existing session structures designated for reuse; and 
selecting one of said existing session structures if there are any available for reuse, and 

otherwise creating a new instance of a session structure for use in processing said second 

message. 



7. (original) Hie method of Claim 6, further comprising: 

using said current set of rules when creating a new instance of a session structure. 

8. (currently amended) The method of Claim 2, wherein each rule in said first set of rules 
has a condition portion and an associated action portion, and the method further comprising: 
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extracting one or more data items usi^g said first message; 

evaluating each condition portion in accordance with said one or more data items; and 
for each condition portion evaluating to true, performing said associated action portion. 

9. (original) The method of Claim 8, wherein said one or more data items include at least 
one of: message origin information, message header information, web service methods, message 

jfc parameter, message metadata, and authentication and authorization data. 

10. (original) The method of Claim 8, wherein said associated action portion includes 
performing at least one of: outputting data, executing an application, and sending a message. 

1 1 . (original) The method of Claim 10, wherein said associated action portion includes 
executing an application and said application is one of: a customized application and an e-mail 
application. 

1 2 . (original) The method of Claim 1 0, wherein said associated action portion includes 
sending a message and said message sent is one of: an e-mail message, and a message in 
accordance with a predefined protocol. 

13. (original) The method of Claim 8, wherein said associated action portion includes 
performing at least one of: rejecting a request, and transferring control to an application in 
accordance with at least one compliance condition. 

14. (original) The method of Claim 13, wherein said at least one compliance condition 
includes a predetermined number of unauthorized accesses. 
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15. (original) The method of Claim 10, wherein said associated action portion includes 
outputting data to at least one of: an event log, a system log, an error log, and a file included in a 



17. (original) The method of Claim 8, further comprising: 

concurrently accessing a commonly accessed resource in accordance with said associated 
action portion. 



synchronizes with processing of another received message when accessing a structure that 
includes one or more session objects for reuse and in connection with a globally accessed 
resource. 

19. (original) The method of Claim 18, wherein said globally accessed resource is a 
resource requiring serial access. 

20. (original) The method of Claim 3, further comprising: 
receiving said first set of rules in one or more messages; 
parsing said first set of rules producing a representation; 

traversing said representation to construct one or more temporary definitions of objects 
in accordance with said first set of rules; 

attempting to instantiate one or more objects in accordance with said one or more 
temporary definitions; 



file system. 





18. (original) The method of Claim 7, wherein processing a received message only 
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determining whether an error has occurred in connection with said attempting to 
instantiate; and 

if no error has occurred in connection with said attempting to instantiate, defining said 
first set of rules as said current set of rules. 

21 , (original) The method of Claim 20, wherein, if no error hzs occmred in connection 
with said attempting to instantiate, discarding any existing session structures designated for reuse 
in connection with processing subsequently received messages. 

22. (original) The method of Claim 20, whenein said specifying a second set of rules in 
real-time includes; 



receiving said second set of rules in one or more messages; 
parsing said second set of rules producing a representation; 

traversing said representation to construct one or more temporary definitions of objects in 
accordance with said second set of rules; 

determining whether there has been a change in one or more object definitions in 
accordance with said one or more temporary definitions and other current definitions associated 
with said current set of rules; 

if there has been a change in one or more object definitions, performing: 

attempting to instantiate one or more objects in accordance with said one or more 
temporary definitions; 

determining whether an error has occurred in connection with said attempting to 
instantiate; and 

if no error has occurred in connection with said attempting to instantiate, defining 
said second set of rules as said current set of rules. 
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23. (original) The method of Claim 22, wherein there has been a change in a first object 
definition and at least one other object definition has not changed, and the method further 
comprising: 

attempting to instantiate only said first object definition that has changed; and 

reusing an existing definition for said at least one other object definition that has not 
changed. 

\ 

a 

24. (currently amended) The method of Claim 1, wherein said Treb comooc application is 
en e of a plurality of applicati u m, providing includes a web services application. 

25. (currently amended) The method of Claim [4J24, wherein said web services 
application is associated with an application server and a stream sensor, said stream sensor 
performing said evaluating. 

26. (original) The method of Claim 1, further comprising: 
using a console to specify said current set of rules. 

27. (original) The methodof Claim 1, further comprising: 

using a non-mteractive input source to specify said current set of rules. 

28. (original) The method of Claim 26, further comprising: 

selecting at least one condition and at least one data item included in said current set of 

rules. 



29. (original) The method of Claim 8, wherein said evaluating each condition portion 
further comprises: 

performing expression processing in accordance with said one or more data items. 
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30. (original) The method of Claim 29, flutter comprising: 

performing format processing in connection with outputting data for an action portion of 
a rule when a condition portion of said rule evaluates to true. 

3 1 . (original) The method of Claim 1 , wherein each rule of said current set of one or 
more rules includes a condition portion and an action portion, said action portion being 
performed if said condition portion evaluates to true. 

32. (original) The method of Claim 31, wherein said condition portion includes a 
reference to a user-defined routine. 

33. (currently amended) The method of Claim 31, wherein said action portion includes 
outputting data to an output destination, and the method further comprising: 

outputting first data to a first output destination executing a first routine in accordance 
with a first condition; and 

outputting second data to a second output destination executing a second routine in 
accordance with a second condition, said first output destination being different from said second 
output destination [,] . 



34. (original) The method of Claim 33, wherein said first routine outputs first data to a 
third routine which aggregates said first data and outputs aggregated first data at predetermined 
time intervals to a third output destination different from said first and second output 
destinations. 



35. (currently amended) The method of Claim 1, wherein said first message received is 
one of; an input message and an output message of said data stream of said web cerviooG 
application distributed computing system . 



PAGE 10/27 1 RCVD AT 7/12J2005 2:47:39 PM [Eastern Daylight Time] 1 SVMSPTO-EFXRMfl > ONIS:8729305 < CSID:6175428906 * DURATION (miM$):07-20 



JUL. 12. 2005 2:55PM 



(3) FISH & RICHARDSON 6175428906 



NO. 1720 P. 11 



Applicant 
Serial No. 
Filed 
Page 



Jason DeBettencourt et aL 
10/649,160 
August 27, 2003 
9 of 25 



Attorney's Docket No. : 1 7542-00200 1 



36. (currently amended) The method of Claim 1, wherein a plurality of mospqgos are 
roceivod and said plurality of messages monitored on the data stream , include at least one input 
message and at least one output message of said data stream of oaid wob oorviceo application, 



38. (original) The method of Claim 15, wherein said system log is a UNIX syslog. 

39. (currently amended) A system for filtering data comprising: 
at least one application providing a service; 

at least one application server and stream sensor associated with each of said at least one 
application, said stream sensor filtering a data stream of said at least one application in 
accordance with a dynamically evaluated current set of rules producing filtered data, said current 
set of rules being dynamically evaluated for received messages; and 

a context engine associated with each of said at least one application, said context engine 
including an aggregation service that aggregates said filtered data for said application in 
accordance with at least one local aggregation condition. 

40. (original) The system of Claim 39, wherein said filtered data is stored in raw data 
files used as input to said aggregation service which output summary data, 

41 . (original) The system of Claim 40, wherein the system includes at least one 
application and a global aggregator gathering output summary data from each aggregation 
service associated with each of said at least one application. 

42. (original) The system of Claim 39, wherein said local aggregation condition is 
aggregating data locally for each transaction. 
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43. (currently amended) A method for capturing data from a data stream of an 
application comprising: 

receiving a first message from said data stream of said application; 

storing first context information representing a first set of one or more rules, said first 
context information describing a processing state of said first message used during a first 
processing lifetime of said first message, said first set of one or more rules used in obtaining first 
data related to said first message, said first set of one or more rules being identified as a current 
set of rules; 

defining a second set of one or more rules at runtime of said application while said 
application is servicing a request such that subsequently received messages are processed in 
accordance with said second set of one or more rules, said second set of one or more rules 
replacing said first set of one or more rules as the current set of rules; 

receiving a second message from said data stream during said first processing Ufetime of 
said first message; and 

storing second context information representing said second set of one or more rules, 
said second context information describing a processing state of said second message used ' 
during a second processing lifetime of said second message, said second set of roles used in 
obtaining second data related to said second message, said first processing lifetime and said 
second processing lifetime overlapping for at least a portion of both lifetimes such that said first 
and second messages are concurrently processed. 

44. (original) The method of Claim 43, further comprising: 

gathering data in accordance with said first message and said first set of one or more 
rules; and 

gathering data in accordance with said second message and said second set of one or 
more rules. 
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45. (original) The method of Claim 44, further comprising: 

detemuning, after processing said fkst message, whether a first data storage area storing 
said first context information can be reused by determining whether a set of rules included in 
said first data storage area is said current set of rules; 

detennining, after processing said second message, whether a second data storage area 
storing said second context information can be reused by detennining whether a set of rules 
included in said second data storage area is said current set of rules; and 

designating said second data storage area for reuse and not designating said first data 
storage area for reuse. 

46. (original) The method of Claim 45, further comprising: 
receiving a third message; 

determining whether there are any available data storage areas designated for reuse; and 
selecting one of said available data storage areas if there are any available and otherwise 

allocating additional storage for storing third context information for said third message, said 

third context information including a copy of said current set of rules. 

47. (original) A computer program product for filtering data from a data stream of a web 
services application comprising: 

executable code that receives a message; 

executable code that evaluates, using data from the message, a current set of one or more 
rules producing a current set of evaluated rules; and 

executable code that collects data associated with the message in accordance with the 
current set of evaluated rules. 

* 

48. (original) The computer program product of Claim 47, wherein said executable code 
that evaluates and collects arc performed in real-time while said web services application is 
servicing requests, and the computer program product further comprising: 
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executable code that performs a service in accordance with said message. 

49. (original) The computer program product of Claim 47, further comprising: 
executable code that specifies a first set of rules; and 

executable code that specifies a second set of rules in real-time while said web services 
application services requests and filters data from said web services application's data stream, 




said second set of rules replacing said first set of rules as said current set of rules. 



50. (original) The computer program product of Claim 49, wherein said message is a 
first message and the computer program product further comprising: 

executable code that associates a first session structure with said first message from said 
data stream, said first session structure including a representation of said first set of rules; and 

executable code that associates a second session structure with a second message fixnn 
said data stream, said second session structure including a representation of said second set of 
rules, a portion of a processing lifetime of said first message overlapping at least a portion of a 
processing lifetime of said second message, each of said processing lifetimes being a time period 
during which an associated message is processed to gather data. 

5 1 . (original) The computer program product of Claim 50, wherein processing of said 
first message is complete and the computer program product further comprising: 

executable code that determines if said first set of rules included in said first session 
structure is a current set of rules; , and 

executable code that designates said first session structure for reuse in processing another 
incoming message if said first set of rules is said current set of rules, 

52. (original) The computer program product of Claim 51, further comprising: 

■ 

i executable code that receives said second message; 
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■ 

executable code that determines whether there are any existing session structures 
designated for reuse; and 

executable code that selects one of said existing session structures if there are any 
available for reuse, and otherwise creates a new instance of a session structure for use in 
processing said second message. 

53. (original) The computer program product of Claim 52, further comprising: 
executable code that uses said current set of rules when creating a new instance of a 
session structure. 



54. (original) The computer program product of Claim 48, wherein each rule in said first 
set of rules has a condition portion and an associated action portion, and the computer program 
product further comprising: 

executable code that extracts one or more data items using said first message; 
executable code that evaluates each condition portion in accordance with said one or 
more data items; and 

executable code that, for each condition portion evaluating to true, performs said 
associated action portion. 

55. (original) The computer program product of Claim 54, wherein said one or more data 
items include at least one of: message origin information, message header information, web 
service methods, message parameter, message metadata, and authentication and authorization 
data. 



56. (original) The computer program product of Claim 54, wherein said associated action 
portion includes performing at least one of: outputting data, executing an application, and 
sending a message. 
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57. (original) The computer prcgram product of Claim 56, wherein said associated action 
portion includes executing an application and said application is one of a customized application 
and an e-mail application, 

58. (original) The computer program product of Claim 56, wherein said associated action 
portion includes sending a message and said message sent is one of: an e-mail message, and a 
message in accordance with a predefined protocol. 

59. (original) The computer program product of Claim 54, wherein said associated action 
portion includes performing at least one ot rejecting a request, and transferring control to an 
application in accordance with at least one compliance condition. 

60. (original) The computer program product of Claim 59, wherein said at least one 
compliance condition includes a predeteimined number of unauthorized accesses. 

61 . (original) The computer program product of Claim 56, wherein said associated action 
portion includes outputting data to at least one of: an event log, a system log, an error log, and a 
file included in a file system. 

62. (original) The computer program product of Claim 54, further comprising: 
executable code that synchronizes access to a commonly accessed resource in accordance 

with said associated action portion. 

63. (original) The computer program product of Claim 54, further comprising: 
executable code that concurrently accesses a commonly accessed resource in accordance 

with said associated action portion. 
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64. (original) The computer program product of Claim 53, comprising executable code 
that, when processing a received message, only synchronizes with processing of another 
received message when accessing a structure (hat includes one or more session objects for reuse 
and in connection with a globally accessed resource. 

65. (original) The computer program product of Claim 64, wherein said globally 
ft accessed resource is a resource requiring serial access. 

66. (original) The computer program product of Claim 49, further comprising: 
executable code that receives said first set of rules in one or more messages; 
executable code that parses said first set of rules producing a representation; 
executable code that traverses said representation to construct one or more temporary 

definitions of objects in accordance with said first set of rules; 

executable code that attempts to instantiate one or more objects in accordance with said 
one or more temporary definitions; 

executable code that determines whether an error has occurred in connection with said 
attempting to instantiate; and 

executable code that, if no error has occurred in connection with attempting to 
instantiate, defines said first set of rules as said current set of rules. 

67. (original) The computer program product of Claim 66, further comprising; 
executable code that, if no error has occurred in connection with attempting to instantiate, 

discards any existing session structures designated for reuse in connection with processing 
subsequently received messages. 

68. (original) The computer program product of Claim 66, wherein said executable code 
that specifies a second set of rules in real-time includes: 

executable code that receives said second set of rules in one or more messages; 
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executable code that parses said second set of rules producing a representation; 

executable code that traverses said representation to construct one or more temporary 
definitions of objects in accordance with said second set of rules; 

executable code that determines whether there has been a change in one or more object 
definitions in accordance with said one or more temporary definitions and other current 
definitions associated with said current set of rules; 

executable code that if there has been a change in one or more object definitions, 
performs: 

attempting to instantiate one or more objects in accordance with said one or more 
temporary definitions; 

deterrnining whether an error has occurred in connection with said attempting to 
instantiate; and 

if no error has occurred in connection with said attempting to instantiate, denning 
said second set of rules as said current set of rules. 



a 



69. (original) The computer program product of Claim 68, wherein there has been 
change in a first object definition and at least one other object definition has not changed, and the 
computer program product further comprising: 

executable code that attempts to instantiate only said first object definition that has 
changed; and 

executable code that reuses an existing definition for said at least one other object 
definition that has not changed. 

70. (original) The computer program product of Claim 47, wherein said web services 
application is one of a plurality of applications providing web services. 



PAGE 18/27 1 RCVD AT 7/1212005 2:47:39 PM [Eastern Daylight rime] ' SVR:USPT0-EFXRMI3 ' DMS:8729306 1 CSID:6175428906 * DURATION (mm-ss):07-20 



JUL. 12. 2005 2:57PM (3) FISH & RICHARDSON 6175428906 

* 



NO. 1720 P. 19 



Applicant 
Serial No. 
Filed 
Page 



Jason DeBettencourt et al. 
10/649,160 
August 27, 2003 
17 of 25 



Attorney's Docket No,: 17542-002001 



71. (original) The computer program product of Claim 47, wherein said web services 
application is associated with an application server and a stream sensor, said stream sensor 
performing including said executable code that evaluates. 

72. (original) The computer program product of Claim 47, further comprising: 
executable code that uses & console to specify said current set of rules. 

73. (original) The computer program product of Claim 47, further comprising: 
executable code that uses a non-interactive input source to specify said current set of 

rules, 

74. (original) The computer program product of Claim 72, further comprising: 
executable code that selects at least one condition and at least one data item included in 

said current set of rules. 

75. (original) The computer program product of Claim 54, wherein said executable code 
that evaluates each condition portion further comprises: 

executable code that performs expression processing in accordance with said one or more 
data items. 

76. (original) The computer program product of Claim 75, further comprising: 
executable code that performs format processing in connection with outputting data for 

an action portion of a rule when a condition portion of said rule evaluates to true. 



Is 



77. (original) The computer program product of Claim 47, wherein each rule of said 
current set of one or more rules includes a condition portion and an action portion, said action 
portion being performed if said condition portion evaluates to true. 
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78. (original) The computer program product of Claim 77, wherein said condition 
portion includes a reference to a user-defined routine. 

79. (original) The computer program product of Claim 77, wherein said action portion 
includes outputting data to an output destination, and the computer program product further 
comprising: 

executable code mat outputs first data to a first output destination executing a first routine 
in accordance with a first condition; and 

executable code that outputs second data to a second output destination executing a 
second routine in accordance with a second condition, said first output destination being different 
from said second output destination. 

80. (original) The computer program product of Claim 79, wherein said first routine 
outputs first data to a third routine which aggregates said first data and outputs aggregated first 
data at predetermined time intervals to a third output destination different from said first and 
second output destinations. 

81. (original) The computer program product of Claim 47, wherein said message 
received is one of: an input message and an output message of said data stream of said web 
services application. 

82. (original) The computer program product of Claim 47, wherein a plurality of 
messages are received and said plurality of messages include at least one input message and at 
least one output message of said data stream of said web services application. 

83. (original) The computer program product of Claim 61, wherein said event log is a 
Windows event log. 
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84. (original) The computer program product of Claim 61, wherein said system log is £ 
UNIX syslog. 

85, (original) A computer program product for capturing data from a data stream of an 
application comprising: 

executable code that receives a first message from said data stream of said application; 
executable code that stores first context infonnation including a copy of a first set of one 



or more rules, said first context information describing a processing state of said first message 
used during a first processing lifetime of said first message, said first set of one or more rules 
used in obtaining first data related to said first message, said first set of one or more rules being 
said current set of rules; 

executable code that defines a second set of one or more rules at runtime of said 
application while said application is servicing a request such that any subsequently received 
messages are processed in accordance with said second set of one or more rules, said second set 
of one or more rules replacing said first set of one or more rules as said current set; 

executable code that receives a second message from said data stream during said first 
processing lifetime of said first message; and 

executable code that stores second context information including a copy of said second 
set of one or more rules, said second context information describing a processing state of said 
second message used during a second processing lifetime of said second message, said second 
set of rules used in obtaining second data related to said second message, said first processing 
lifetime and said second processing lifetime overlapping for at least a portion of both lifetimes 
such that said first and second messages are concurrently processed. 

86. (original) The computer program product of Claim 85, further comprising: 
executable code that gathers data in accordance with said first message and said first set 
of one or more rules; and 
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executable code that gathers data in accordance with said second message and said 
second set of one or more rules. 

87. (original) The computer program product of Claim 86, further comprising: 
executable code that determines, after processing said first message, whether a first data 

storage area storing said first context information can be reused by detennining whether a set of 
rules included in said first data storage area is said current set of rules; 

executable code that detennines, after processing said second message, whether a second 
data storage area storing said second context information can be reused by determining whether a 
set of rules included in said second data storage area is said current set of rules; and 

executable code that designates said second data storage area for reuse and not 
designating said first data storage area for reuse. 

88. (original) The computer program product of Claim 87, further comprising: 
executable code that receives a third message; 

executable code that determines whether there are any available data storage areas 
designated for reuse; and 

executable code that selects one of said available data storage areas if there are any 
available and otherwise allocating additional storage for storing third context information for 
said third message, said third context, information including a copy of said current set of rules. 

89. (previously presented) The method of Claim 1, wherein the distributed computing 
system includes a web services application and the data stream is associated with (he web 
services application. 

90. (currently amended) The method of Claim 2, wherein said evaluating and said 
gathering recording are performed in real time. 
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9 1 . (currently amended) Hie method of Claim 2, furthering comprising: 
performing, by said wwb rr orviooo applica t i o n distributed comp u ting system a service in 

accordance with said message, 

92. (previously presented) Hie method of Claim 3, wherein the specifying of die second 
set of rules is performed in real time. 

93. (previously presented) The method of Claim 4, wherein each of said processing 
lifetimes is a time period during which an associated message is processed to gather data. 

[<&]94. (currently amended) The system of Claim 39, wherein said current set of rules 
are dynamically evaluated for each received message. 

mm.> (currently amended) The method of Claim 43, wherein the first context 
information includes a copy of the first set of one or more rules and the second context 
information includes a copy of the second set of one or more rules. 

[9S]96. (cunently amended) The method of Claim 43, further comprising: 

setting a current set of rules to be the first set of rules; and 

replacing the first set of rules with the second set of rules as the current set of rules. 

mm, (currently amended) The method of Claim 43, where said first processing 
lifetime and said second processing lifetime overlapping for at least a portion of both lifetimes 
such that said first and second messages are concurrently processed. 
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